Building for Trust: How to Secure Your Kubernetes Cluster
summary
Covers concrete hardening: cluster uses a cluster CA with per-node certs and service account tokens stored as Kubernetes secrets, API access is controlled with RBAC (1.6 → 1.7 moves toward fine-grained node identities), audit logs record API calls, and certificate rotation is planned. Runtime hardening demos use seccomp default and custom profiles plus AppArmor/SELinux and cgroups; a custom seccomp profile blocks madvise and prevents a Dirty COW exploit from escalating on a labeled node, while the same pod without the profile successfully pwns the vulnerable node.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:33Security model: stages Single tenant
- 5:25System authentication: one example config
- 6:37Workload authentication who is the pod?
- 7:33Authorization: what can you do?
- 10:43Audit Logs
- 11:52Non-Kubernetes Auth: Secrets
- 12:55What is a container?
- 16:04Security context
- 32:42Recap
related talks
29mKubernetes Security Best Practices
38mAn Intro to Kubernetes Hardening
22mSecuring Kubernetes
25mSecuring and Hardening Your Kubernetes Cluster
46mContinuous Kubernetes Security
34mKubernetes Security 101: Best Practices to Secure Your Cluster
53mFlying Above the Clouds: Securing Kubernetes
35mKubernetes Security - Challenge and Opportunity?